Description of problem:
Enable "Check Spelling" in text box -> firefox freezes

(gdb) bt
#0  0x0012e416 in __kernel_vsyscall ()
#1  0x003605f3 in __lll_lock_wait_private () from /lib/libc.so.6
#2  0x002e704d in _L_lock_4627 () from /lib/libc.so.6
#3  0x002e383a in __libc_free (mem=0x9e54380) at malloc.c:3623
#4  0x00666f03 in nsProfileLock::Unlock (this=0x9e540d4)
    at nsProfileLock.cpp:658
#5  0x00666f55 in nsProfileLock::RemovePidLockFiles () at nsProfileLock.cpp:150
#6  0x0066715b in nsProfileLock::FatalSignalHandler (signo=6)
    at nsProfileLock.cpp:165
#7  <signal handler called>
#8  0x0012e416 in __kernel_vsyscall ()
#9  0x0029e660 in raise (sig=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
#10 0x002a0028 in abort () at abort.c:88
#11 0x002db5bd in __libc_message (do_abort=2, 
    fmt=0x3aeca4 "*** glibc detected *** %s: %s: 0x%s ***\n")
    at ../sysdeps/unix/sysv/linux/libc_fatal.c:170
#12 0x002e17e4 in malloc_printerr (action=2, 
    str=0x3acf67 "free(): invalid pointer", ptr=0xc268dd8) at malloc.c:5949
#13 0x002e3846 in __libc_free (mem=0xc268dd8) at malloc.c:3625
#14 0x00eb33bd in nsStringBuffer::Release (this=0xc268dd8)
    at nsSubstring.cpp:197
#15 0x00eb3a96 in nsAString_internal::Finalize (this=0x0)
    at nsTSubstring.cpp:188
---Type <return> to continue, or q <return> to quit---
#16 0x00e646b6 in nsStringArray::Clear (this=0xbf86c73c)
    at ../../dist/include/string/nsTString.h:51
#17 0x00e646e1 in ~nsStringArray (this=0xbf86c73c) at nsVoidArray.cpp:729
#18 0x00d46bfc in nsEditorSpellCheck::GetDictionaryList (this=0xab8db28, 
    aDictionaryList=0xbf86c840, aCount=0xbf86c850)
    at nsEditorSpellCheck.cpp:423
#19 0x00ea5a05 in NS_InvokeByIndex_P ()
   from /usr/lib/xulrunner-1.9pre/libxul.so
#20 0x0068f325 in XPCWrappedNative::CallMethod (ccx=@0xbf86ca04, 
    mode=XPCWrappedNative::CALL_METHOD) at xpcwrappednative.cpp:2388
#21 0x006973f3 in XPC_WN_CallMethod (cx=0xa044090, obj=0xaa87ba0, argc=2, 
    argv=0xa28c43c, vp=0xbf86cb44) at xpcwrappednativejsops.cpp:1473
#22 0x0041ef2a in js_Invoke (cx=0xa044090, argc=2, vp=0xa28c434, flags=2)
    at jsinterp.c:1296
#23 0x0041f27b in js_InternalInvoke (cx=0xa044090, obj=0xaa87ba0, 
    fval=178813984, flags=0, argc=2, argv=0xa28c418, rval=0xbf86cc70)
    at jsinterp.c:1368
#24 0x003ea4ca in JS_CallFunctionValue (cx=0xa044090, obj=0xaa87ba0, 
    fval=178813984, argc=2, argv=0xa28c418, rval=0xbf86cc70) at jsapi.c:5054
#25 0x0069a8a5 in XPC_NW_FunctionWrapper (cx=0xa044090, obj=0xaa87bc0, argc=2, 
    argv=0xa28c418, rval=0xbf86cdb4) at XPCNativeWrapper.cpp:442
#26 0x0041ef2a in js_Invoke (cx=0xa044090, argc=2, vp=0xa28c410, flags=2)
    at jsinterp.c:1296
---Type <return> to continue, or q <return> to quit---
#27 0x0041307c in js_Interpret (cx=0xa044090) at jsinterp.c:4851
#28 0x0041ef79 in js_Invoke (cx=0xa044090, argc=2, vp=0xa28c1ac, flags=1)
    at jsinterp.c:1312
#29 0x0041f1a8 in js_InvokeConstructor (cx=0xa044090, argc=2, vp=0xa28c1ac)
    at jsinterp.c:1866
#30 0x004164d0 in js_Interpret (cx=0xa044090) at jsinterp.c:3814
#31 0x0041ef79 in js_Invoke (cx=0xa044090, argc=1, vp=0xa28c19c, flags=0)
    at jsinterp.c:1312
#32 0x0041f27b in js_InternalInvoke (cx=0xa044090, obj=0xa7300e0, 
    fval=177967616, flags=0, argc=1, argv=0xa28c198, rval=0xbf86d680)
    at jsinterp.c:1368
#33 0x003ea4ca in JS_CallFunctionValue (cx=0xa044090, obj=0xa7300e0, 
    fval=177967616, argc=1, argv=0xa28c198, rval=0xbf86d680) at jsapi.c:5054
#34 0x00a76cce in nsJSContext::CallEventHandler (this=0x9f9b9c0, 
    aTarget=0xa42faf0, aScope=0xa1dd9a0, aHandler=0xa9b9200, aargv=0xa3f5878, 
    arv=0xbf86d7e0) at nsJSEnvironment.cpp:1962
#35 0x00aaf5b4 in nsJSEventListener::HandleEvent (this=0xa42fb78, 
    aEvent=0xc410198) at nsJSEventListener.cpp:248
#36 0x0097b9f5 in nsEventListenerManager::HandleEventSubType (this=0xa42fb18, 
    aListenerStruct=0xab8d390, aListener=0xa42fb78, aDOMEvent=0xc410198, 
    aCurrentTarget=0xa42faf0, aPhaseFlags=6) at nsEventListenerManager.cpp:1080
#37 0x0097bf0b in nsEventListenerManager::HandleEvent (this=0xa42fb18, 
    aPresContext=0xa399140, aEvent=0xbf86dac8, aDOMEvent=0xbf86da64, 
---Type <return> to continue, or q <return> to quit---
    aCurrentTarget=0xa42faf0, aFlags=6, aEventStatus=0xbf86da68)
    at nsEventListenerManager.cpp:1184
#38 0x009954dd in nsEventTargetChainItem::HandleEvent (this=0xc40fdf8, 
    aVisitor=@0xbf86da5c, aFlags=6) at nsEventDispatcher.cpp:210
#39 0x009955e5 in nsEventTargetChainItem::HandleEventTargetChain (
    this=0xc40fe98, aVisitor=@0xbf86da5c, aFlags=6, aCallback=0x0)
    at nsEventDispatcher.cpp:268
#40 0x0099595c in nsEventDispatcher::Dispatch (aTarget=0xa42faf0, 
    aPresContext=0xa399140, aEvent=0xbf86dac8, aDOMEvent=0x0, 
    aEventStatus=0xbf86db24, aCallback=0x0) at nsEventDispatcher.cpp:483
#41 0x0090a122 in nsXULPopupManager::FirePopupShowingEvent (this=0x9e50900, 
    aPopup=0xa42faf0, aMenu=0x0, aPresContext=0xa399140, 
    aPopupType=ePopupTypeMenu, aIsContextMenu=1, aSelectFirstItem=0)
    at nsXULPopupManager.cpp:1001
#42 0x0090a6d9 in nsXULPopupManager::ShowPopupAtScreen (this=0x9e50900, 
    aPopup=0xa42faf0, aXPos=1471, aYPos=185, aIsContextMenu=1, 
    aTriggerEvent=0xc40f4f0) at nsXULPopupManager.cpp:475
#43 0x00b081fd in nsXULPopupListener::LaunchPopup (this=0xa7a1410, 
    aEvent=0xc40f4f0, aTargetContent=0xc108850) at nsXULPopupListener.cpp:473
#44 0x00b08cc7 in nsXULPopupListener::PreLaunchPopup (this=0xa7a1410, 
    aMouseEvent=0xc40f4f0) at nsXULPopupListener.cpp:243
#45 0x0097bf67 in nsEventListenerManager::HandleEvent (this=0xa7a1430, 
    aPresContext=0xc1743f0, aEvent=0xbf86e190, aDOMEvent=0xbf86def4, 
---Type <return> to continue, or q <return> to quit---
    aCurrentTarget=0xa7ed500, aFlags=2, aEventStatus=0xbf86def8)
    at nsEventListenerManager.cpp:184
#46 0x009954dd in nsEventTargetChainItem::HandleEvent (this=0xc40fc98, 
    aVisitor=@0xbf86deec, aFlags=2) at nsEventDispatcher.cpp:210
#47 0x0099566f in nsEventTargetChainItem::HandleEventTargetChain (
    this=0xc40fdd8, aVisitor=@0xbf86deec, aFlags=6, aCallback=0xbf86df60)
    at nsEventDispatcher.cpp:291
#48 0x0099595c in nsEventDispatcher::Dispatch (aTarget=0xb439e218, 
    aPresContext=0xc1743f0, aEvent=0xbf86e190, aDOMEvent=0x0, 
    aEventStatus=0xbf86e058, aCallback=0xbf86df60) at nsEventDispatcher.cpp:483
#49 0x007f4482 in PresShell::HandleEventInternal (this=0xc26ab78, 
    aEvent=0xbf86e190, aView=0xc246000, aStatus=0xbf86e058)
    at nsPresShell.cpp:5921
#50 0x007f4c21 in PresShell::HandlePositionedEvent (this=0xc26ab78, 
    aView=0xc246000, aTargetFrame=0xb439d634, aEvent=0xbf86e190, 
    aEventStatus=0xbf86e058) at nsPresShell.cpp:5809
#51 0x007f502b in PresShell::HandleEvent (this=0xc26ab78, aView=0xc246000, 
    aEvent=0xbf86e190, aEventStatus=0xbf86e058) at nsPresShell.cpp:5669
#52 0x00a6d62e in nsViewManager::HandleEvent (this=0xc245fa0, aView=0xc246000, 
    aPoint={x = -1081679628, y = -1081679472}, aEvent=0xbf86e190, aCaptured=0)
    at nsViewManager.cpp:1382
#53 0x00a6f3a7 in nsViewManager::DispatchEvent (this=0xc245fa0, 
    aEvent=0xbf86e190, aStatus=0xbf86e140) at nsViewManager.cpp:1337
---Type <return> to continue, or q <return> to quit---
#54 0x00a6a098 in HandleEvent (aEvent=0xbf86e190) at nsView.cpp:168
#55 0x00dc5a38 in nsCommonWidget::DispatchEvent (this=0xb43988c8, 
    aEvent=0xbf86e190, aStatus=@0xbf86e238) at nsCommonWidget.cpp:158
#56 0x00dc0052 in nsWindow::OnButtonPressEvent (this=0xb43988c8, 
    aWidget=0x9f1b318, aEvent=0xbe63010) at nsWindow.cpp:2154
#57 0x00dc00bf in button_press_event_cb (widget=0x9f1b318, event=0xbe63010)
    at nsWindow.cpp:4653
#58 0x030cfae8 in _gtk_marshal_BOOLEAN__BOXED (closure=0xa167930, 
    return_value=0xbf86e420, n_param_values=2, param_values=0xbf86e4d8, 
    invocation_hint=0xbf86e40c, marshal_data=0x0) at gtkmarshalers.c:84
#59 0x01a0f12b in IA__g_closure_invoke (closure=0xa167930, 
    return_value=0xbf86e420, n_param_values=2, param_values=0xbf86e4d8, 
    invocation_hint=0xbf86e40c) at gclosure.c:490
#60 0x01a23995 in signal_emit_unlocked_R (node=0x9efd970, detail=0, 
    instance=0x9f1b318, emission_return=0xbf86e698, 
    instance_and_params=0xbf86e4d8) at gsignal.c:2440
#61 0x01a24d58 in IA__g_signal_emit_valist (instance=0x9f1b318, signal_id=45, 
    detail=0, var_args=0xbf86e6f0 "\f�\206�\005") at gsignal.c:2209
#62 0x01a25336 in IA__g_signal_emit (instance=0x9f1b318, signal_id=45, 
    detail=0) at gsignal.c:2243
#63 0x0325dc59 in gtk_widget_event_internal (widget=0x9f1b318, event=0xbe63010)
    at gtkwidget.c:4676
#64 0x0325d75f in IA__gtk_widget_event (widget=0x9f1b318, event=0xbe63010)
---Type <return> to continue, or q <return> to quit---
    at gtkwidget.c:4476
#65 0x030cde83 in IA__gtk_propagate_event (widget=0x9f1b318, event=0xbe63010)
    at gtkmain.c:2336
#66 0x030cc7a1 in IA__gtk_main_do_event (event=0xbe63010) at gtkmain.c:1541
#67 0x01ba421c in gdk_event_dispatch (source=0x9e30390, callback=0, 
    user_data=0x0) at gdkevents-x11.c:2365
#68 0x03b22098 in IA__g_main_context_dispatch (context=0x9e303d8)
    at gmain.c:2009
#69 0x03b25743 in g_main_context_iterate (context=0x9e303d8, block=1, 
    dispatch=1, self=0x9e0be80) at gmain.c:2642
#70 0x03b25901 in IA__g_main_context_iteration (context=0x9e303d8, may_block=1)
    at gmain.c:2705
#71 0x00dc4124 in nsAppShell::ProcessNextNativeEvent (this=0x9ecfae8, 
    mayWait=1) at nsAppShell.cpp:144
#72 0x00ddad34 in nsBaseAppShell::DoProcessNextNativeEvent (this=0x9ecfae8, 
    mayWait=1) at nsBaseAppShell.cpp:151
#73 0x00ddaecb in nsBaseAppShell::OnProcessNextEvent (this=0x9ecfae8, 
    thr=0x9e53d90, mayWait=1, recursionDepth=0) at nsBaseAppShell.cpp:296
#74 0x00e9876e in nsThread::ProcessNextEvent (this=0x9e53d90, mayWait=1, 
    result=0xbf86e9e4) at nsThread.cpp:497
#75 0x00e6576c in NS_ProcessNextEvent_P (thread=0xad9, mayWait=1)
    at nsThreadUtils.cpp:227
#76 0x00ddb014 in nsBaseAppShell::Run (this=0x9ecfae8)
---Type <return> to continue, or q <return> to quit---
    at nsBaseAppShell.cpp:170
#77 0x00c8f7fc in nsAppStartup::Run (this=0x9f46540) at nsAppStartup.cpp:181
#78 0x0065fe91 in XRE_main (argc=1, argv=0xbf8720f4, aAppData=0x9e0b9e0)
    at nsAppRunner.cpp:3170
#79 0x08049169 in main (argc=1, argv=0xbf8720f4) at nsXULStub.cpp:364
(gdb) 
Version-Release number of selected component (if applicable):
3.0-0.63.cvs20080516.fc10

How reproducible:
sometiems or with frequency 

Steps to Reproduce:
1.  connect a website (like google)
2. Enable "Check Spelling" in text box
3.
  
Actual results:


Expected results:


Additional info:
xulrunner-1.9-0.63.cvs20080516.fc10
firefox-3.0-0.63.cvs20080516.fc10.i386
hunspell-1.2.2-3.fc10.i386